TOTOLINK A3000RU Command Injection

/in /by

Zioncom (Hong Kong) Technology Limited also know as TOTOLINK is a professional manufacturer for network communication products, including Wireless Router/AP (Indoor & Outdoor), Wireless USB Adapter, Wireless Module, Switch and Wired Router. ZIONCOM (HK) was established on 1999.

A3000RU is a wireless router complies with the latest IEEE 802.11ac wave2 Wi-Fi standard, with MU-MIMO technology offering continual high speed data transmission for multiple devices at the same time.

Command injection vulnerability exists in TOTOLINK A3000RU router.

Command Injection Vulnerability
The goal of command injection attack is the execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user-supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation

TOTOLINK A3000RU Command Injection | CVE-2022-25075
TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the “Main” function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.

In the following exploit the attacker can pass commands like ‘wget’ via the query string . This command is used to download toto.sh script from the attacker controlled website. The attacker then changes the permissions of the script and executes the malicious script on the device.

 

SonicWall Capture Labs provides protection against this threat via following signature:

  • IPS 15515:TOTOLINK A3000RU Command Injection

IoCs
179.43.142.11
36db973e85684633846a2cd9c46ca48896b5703b9aeb174b1f741633428f68c1

Threat Graph

Raspberry Robin Malware Is An Obfuscated Onion

/in /by

This week, the SonicWall Capture Labs Threat Research Team analyzed a new sample of Raspberry Robin. First observed in May 2022 by Red Canary, Raspberry Robin is a worm that has evolved to be a delivery system for a host of threat actors and malware platforms (This currently includes EvilCorp, LockBit, BumbleBee, IcedID, and DEV-0950). It is unique in that the authors are using a custom obfuscation method that virtualizes the code and has 15+ layers to prevent detection and/or analysis, as well as deploying a custom Tor client for C2 communications.

Infection Chain

Raspberry Robin is known to spread via infected USB devices, utilizing the ‘AutoRun’ feature on plugin. The malware will run via a .LNK file on the USB drive that executes ‘MSIExec.exe’ to download a first-stage payload. Once the system is found to be a valid target, the second-stage payload drops and connects to a Tor address. Initial analysis of the dropper program shows that it begins as a small .zip file (950kb-1250kb) which unpacks another .zip file of roughly the same size. This second archive unpacks into a ~700MB setup file with a .cpl (Control Panel Item) extension, and a text file with instructions to run the installation (Figure 1). Successful execution creates persistence with a RunOnce Key in the registry (HKEY_CURRENT_USER/ and the next stage is downloaded.

Analysis


Figure 1: First stage that creates a .LNK file on any attached USB

The first item to note is the size of the dropper: a 700mb file once unpacked. Most of this is garbage data located within the final section (Figure 2). The massively inflated size is an attempt to bypass scanning by some AV/EDR products, as well as prevent it from being uploaded to public sandboxes.

Figure 2: Note the bottom section ‘.rxy’ has a massive size; it is nothing but the character ‘[‘ repeated

Figure 3: PeStudio results of the secondary layer showing no libraries, imports, exports

Both the dropper and the payload are built with multiple layers of anti-analysis techniques; each is more akin to a virtually-protected machine than an obfuscated file. There are no strings or imports, and thus no API calls to use for context (or use breakpoints with) in a debugger.

Figure 4: Obfuscation through instruction

Every instruction is a series of mathematical actions (add, sub, mul, etc) to change flags, memory offsets, and dynamically call imports. Though no packer is listed with any static analysis tool, this behavior closely resembles how VMProtect works to virtualize runtime and prevent or hinder analysis. Attempting to run the malware in multiple virtual environments failed to produce malicious activity, but several tools were immediately shutdown when loading the sample for analysis. The DLL file will also unload itself when attempting to use a debugger.

This sample is known to drop a fake payload to distract an analyst or AV/EDR tool, located in ‘C:\User\AppData\Local\Temp’. The real payload will use a custom Tor client and reach out to a random hard-coded address for additional payloads or C2 activities. While targets have mostly been government and telecom agencies, there is no reason why other industries couldn’t be affected in the future. Given the sophistication of Raspberry Robin, care should be taken with USB drives and Windows policies on auto-running content.

SonicWall Capture Labs provides protection against this threat via the following signatures:

  • GAV:RaspberryRobin.A (Dropper)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

Cybersecurity News & Trends – 12-16-2022

/0 Comments/in /by

SonicWall curates important news stories and trends from all over the world to help you understand the state of cybersecurity.

SonicWall is on a roll with news from partners in Latin America and the big news that its next-generation firewalls won CRN’s prestigious 2022 Products of the Year Awards.

Industry news reveals that law enforcement from the US, Netherlands and the UK have ‘powered down’ a major DDoS service provider. This report has contributions from the US Department of Justice, the UK National Crime Agency, Tech Crunch, Hacker News, and Krebs on Security.

Reuters reported that a former Twitter employee earned 3-1/2 years of prison for spying for Saudi Arabia.

According to Bleeping Computer, Social Blade, a data analytics provider, was breached, and hackers are selling the data on a hacking forum.

Then from Hacker News, another large Australian company was hacked. This time, it’s TPG Telecom’s turn.

According to Dark Reading, the Iranian state-sponsored cyber-attack APT group known as ‘Charming Kitten’ is including murder for hire and kidnapping as part of its operations.

And finally, SCMagazine reports that Microsoft is blocking threat actors that obtained signed drivers to deploy ransomware. The story also advises that all Windows administrators and even home users install critical security updates as soon as possible.

Remember that cybersecurity is everyone’s business. Be safe out there!

SonicWall News

Risks That Could Impact Retail In 2023

BizCommunity, SonicWall News: Figures from SonicWall’s Biannual Report revealed that e-commerce and online retail businesses saw a 264% surge in the past 12 months in ransomware attacks alone. These statistics are extremely worrying for retail companies, so unsurprisingly, websites and digital security are at the forefront of retailers’ minds.

SonicWall Achieves Sales Record with The Help of The Distribution Channel

InfoChannel (Mexico), SonicWall News: 2022 has been a year of growth for SonicWall, especially for business partners, as announced by Eustolio Villalobos, general manager for Mexico, Central America and the Caribbean. Villalobos said that the company reached a record of internal sales in generation 7, SD-WAN and Wi-Fi 6 firewall solutions.

Unifying Efforts with Its SonicWall Channels Gains Ground in Latin America

eSemenal (Mexico), SonicWall News: Today we have seen how companies are more aware of the cybersecurity challenges they face and have understood that it is not a separate issue. Expanding issues such as hybrid work and 5G will be some of the main challenges next year, and companies regardless of their size will have to be prepared,” said Arley Brogiato, Sales Leader for SonicWall in Latin America.

According to the executive, sales of security solutions this year exceeded the company’s expectations globally, achieving higher growth than the prospect and a double-digit increase in its market shares.

SonicWall Earns Multiple Channel Awards, Delivers More Value and Savings to Global Partner Community

PR Newswire, SonicWall News: SonicWall today announced that its next generation firewalls were a winner in CRN’s prestigious 2022 Products of the Year Awards, notching yet another award in an impressive run for the company that is diligently driving new and innovative strategies to its partners offset rising costs industry-wide.

2022 Cybersecurity Challenges and 2023 Predictions

Total Security Advisor, SonicWall News: Ransomware will continue to be a leading way for bad actors to leverage control and data to monetize hacking organizations. According to the SonicWall Cyber Threat Report, the global volume of ransomware is increasing by 98%. Although this number is down from a 105% increase in 2021, the frequency and dollars spent continue to grow. Globally, healthcare, financial services, manufacturing, and state and local governments continue to see a rise in the frequency of attacks. Interestingly, a growing trend in this game of cat and mouse is that you may pay the ransom and still not be set free from the hacker’s control.

The Art of Cyberwarfare: Sun Tzu and Cybersecurity

Solutions Numeriques (FR), Reprint from SonicWall Blog: SonicWall is organizing an event on this theme of the Art of War: December 15, presented by Guillaume Sevrin, SonicWall EMEA pre-sales manager.

Ransomware Gang Makes $100 Million

Cyber Security Intelligence, SonicWall News: The retail sector is a specific target for Hive ransom attacks and this confirmed by an authoritative threat report by SonicWall, which found that retailers saw a 90% increase in ransomware attacks in 2022, whereby hackers attempt to cripple their day-to-day infrastructure.

Why The Race to Deliver Products Faster Could Be Hampering Product Security

Business Reporter, SonicWall News: Combining these factors with the avalanche of cyber-attacks on connected devices makes the challenge even more insurmountable. According to SonicWall, the total number of malware attacks on IoT-enabled devices rose by 77 per cent in the first half of 2022 to an alarming 57 million. The number of “never-before-seen” malware variants, that are the hardest to defend against, also rose by 45 per cent in the period.

Infinigate To ‘Take Breath’ Before Shifting M&A Focus to Bolt-On Deals, UK Boss Reveals

CRN UK, SonicWall News: “Looking at the enlarged UK business, Griffiths said that Nuvias hands it “scale and power”. While Infinigate’s largest vendors were Progress Software and SonicWall, Nuvias held bigger partnerships with the likes of Juniper Networks.”

Chartered Status and Aligned Standards Are Crucial for The UK’s Cyber Sector

Computer Weekly, SonicWall News: SonicWall’s 2022 Cyber threat report states that ransomware incidents on governments across the globe increased by 1,885% last year, with the healthcare industry alone suffering a 755% increase.

Benefits Of VPN For Small Businesses

GIS User, SonicWall News: We recommend using a reliable VPN service that uses military-grade encryption, such as SonicWall VPN. It has a wide range of features and is very affordable. It is important to note that not all VPN services are created equal, so it is essential to do your research before choosing one.

Cyber Predictions for 2023

Cyber Magazine, SonicWall News: We can expect smaller scale attacks, for lower amounts of money, but which target a much broader base. The trend will probably hit education providers hard: education is already the sector most likely to be targeted by a malware, cryptojacking or encrypted attack, according to SonicWall’s 2022 Cyber Threat Report.

Industry News

Operation PowerOFF: Major DDoS Service Providers Hit Hard

The FBI working with law enforcement in California, Alaska, the Netherlands and the UK National Crime Agency, has shut down 50 domains involved in selling denial-of-service-for-hire tools to the public. In addition, six people in California and Alaska were charged with directing what are known as “booter” and “stressor” services. They are joined by one other individual from the UK whom authorities identified as a site administrator.

A booter service allows anyone to order DDoS attacks for a minimal monthly fee. They may have a simple front end and Web interface, email support, and detailed tutorials. The services often provide the user with a set of attack vectors and the ability to select a target and its IP address. The attacker can then use the service’s attack infrastructure to launch a DDoS attack. The service operators often prefer to use bitcoins as a payment method. Most of the booter services are run by teenagers or young adults. The service typically offers a variety of membership options and may include email support, detailed tutorials, and YouTube instructional exercises.

The sites seized were among the most extensive DDoS-for-hire services in the market. They had a six-month lifecycle and were typically located in North America, Israel, or Europe.

This summary is a compilation of contributions from the US Department of Justice, the UK National Crime Agency, Tech Crunch, Hacker News, and Krebs on Security.

Ex-Twitter worker gets 3-1/2-year US prison term for spying for Saudi Arabia

From Reuters, a California judge sentenced an ex-Twitter employee to three and a half years in prison for spying for Saudi Arabia and sharing user data several years ago and potentially exposing users to persecution. According to a US Dept of Justice press release, Ahmad Abouammo was accused of being paid to obtain information about Twitter users who were critics and dissidents of the kingdom. One of the bribes was a Hublot watch that the man offered for sale on Craigslist for $42,000. Prosecutors also said that he received another $200,000.

Social Blade confirms breach after hacker posts stole user data

According to a report from Bleeping Computer, a data analytics tool known as Social Blade suffered a data breach after its database was stolen and up for sale on a hacking forum. Social Blade provides statistical graphs for YouTube, Twitter, Twitch, Daily Motion, Mixer, and Instagram, allowing customers to see estimated earnings and projects. According to Bleeping Computer, the attacker found a security gap to gain access. The data stolen includes usernames, email addresses, and password hashes. The company clarified that the security incident did not expose any credit card information.

Hackers Breach TPG Telecom Email Host

From HackRead, another large Australian company was hacked. This time, it’s TPG Telecom’s turn. According to a TPG Telecom letter, hackers breached their Microsoft Exchange server. Around 15,000 email accounts were affected, and these seemed to be owned by business users. The company also reported that hackers appeared to be searching for customers’ cryptocurrency and financial information. Neither the company nor other reports offered further details, but an investigation into the attack continues. Recent targets were also Optus telecom and Medibank private health services.

Iran-Backed Charming Kitten APT Eyes Kinetic Ops, Kidnapping

More information is trickling in about an Iranian-based cyber-attack group called TA453, but other researchers refer to it as Charming Kitten or Phosphorous. According to Dark Reading, this group is classified as a state-sponsored advanced persistent threat (APT). The group usually targets academics, researchers and journalists with sometimes deadly expertise. Attacks can begin with benign email conversations that last for weeks before the victim receives a message with malicious links or documents. For example, one victim was the press secretary for an American government official. A second target, an American academic, was sent a suspicious message by a hacked email account of a reporter. But the truly chilling thing about this group is that in the latest campaigns, researchers have observed more aggressive activity, which agents could use to support attempted “kinetic operations,” including murder for hire and kidnapping.

Microsoft blocks threat actors that obtained signed drivers to deploy ransomware

From SCMagazine’s threat intelligence reporters, Microsoft disclosed Tuesday that it suspended several developer program accounts that obtained drivers certified by its Windows Hardware Developer Program. The accounts, the report claims, likely deployed ransomware on telecommunications, outsourcing companies, MSSPs and financial services.

Certificates for the impacted files were revoked in Microsoft’s latest patch Tuesday on Dec. 13, and the seller accounts were suspended. In addition, Microsoft said it also implemented blocking detections against legitimately signed drivers being used maliciously for post-exploit activity. The Dec. 13’s Patch also includes fixes for 48 vulnerabilities found in its products, six of which were listed as critical.

This leads us to a general advisory for Windows administrators and users at home: install the Windows security updates released in September and now December as soon as possible.

SonicWall Blog

‘3 & Free’ Promotion: How to Upgrade to a New SonicWall TZ Series NGFW for Free – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

3 & Free: 1 Amazing Deal, 2 Exceptional Firewalls, 3 Years of Superior Threat Protection – Matt Brennan

SonicWall Wins CRN’s 2022 Tech Innovator Award in Enterprise Network Security – Bret Fitzgerald

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

A New Era of Partnering to Win – Robert (Bob) VanKirk

Multiply Your Security with Multifactor Authentication – Amber Wolff

10 Reasons to Upgrade to the Latest SonicWall Gen 7 TZ Firewall – Sarah Choi

SonicWall Third-Party Threat Performance: Seven Times Superior – Amber Wolff

Q3 2022 Threat Intelligence Highlights Changing Threat Environment in 2022 – Amber Wolff

Securing Your Credentials: Does Your Password Pass the Test? – Amber Wolff

The Power of Patching: Why Updating Your Software Should Be a Top Priority

Think Before You Click: Spotting and Stopping a Phish – Amber Wolff

National Cybersecurity Awareness Month Spotlights the Role of Individuals in Stopping Attacks – Amber Wolff

Seamless Security: How SonicWall Solutions Work Together to Safeguard Your Organization – Sarah Choi

SonicWall’s Nicola Scheibe Recognized by CRN as One of 2022’s 100 People You Don’t Know But Should – Bret Fitzgerald

SonicWall NSM 2.3.4 Uplevels Central Management Capabilities – Amber Wolff

Why 5G Needs to Start with Secure Network Access – Rishabh Parmar

Security Platform Vendors vs. Best-of-Breed Approach to Security Architecture – Rajesh Agnihotri

Why Organizations Should Adopt Wi-Fi 6 Now – David Stansfield

Cryptonite Ransomware leaves files unrecoverable

/in /by

This week, the Sonicwall Capture Labs Research team analyzed a ransomware called Cryptonite. It is an open-sourced ransomware that was once available on GitHub but has now been taken down. It exhibited behavior consistent of most ransomware but later versions were found to malfunction and leaving encrypted data unrecoverable.

Infection Cycle:

The ransomware installer arrives as a fake windows update and can use the following filename:

  • WindowsUpdate.exe

This ransomware is written in Python thus a Python interpreter needs to be present in the victim’s machine for it to successfully run. Therefore upon execution, all the necessary files and modules are dropped in the temp directory under a randomly named folder.

A window then pops up showing the status of the supposed download of a software update, complete with the progress bar.

Meanwhile, encryption of the files are happening in the background. Encrypted files have the file extension “.cryptn8” appended to them.

This ransomware uses the Python cryptography module and more specifically uses an implementation of Fernet to perform encryption.

In our static analysis, we found that this unique key generated using this Fernet implementation appears to be sent out to a remote server hosted on this domain – hxxps://e4c0660414bf.eu.ngrok.io

Upon successful encryption a standard warning message is then presented to the victim which allows the victim to enter a decryption key if they decide to contact the ransomware operator.

However, later samples have been found to not complete the entire infection cycle. During encryption the ransomware application abruptly crashes with an error. Encryption completes but that key never gets sent to the remote server leaving the files unrecoverable. Subsequent execution of the ransomware just encrypts the already encrypted files and thus ransomware essentially just wiped out the data in the victim’s machine.

SonicWall Capture Labs provides protection against this threat via the following signature:

  • GAV: Cryptonite.RSM  (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.

 

 

Microsoft Security Bulletin Coverage for December 2022

/in /by

SonicWall Capture Labs threat research team has analyzed and addressed Microsoft’s security advisories for the month of December 2022. A list of issues reported, along with SonicWall coverage information, is as follows:

CVE-2022-44673 Windows Client Server Run-Time Subsystem (CSRSS) Elevation of Privilege Vulnerability
ASPY: 387: Malicious-exe exe.MP_291

CVE-2022-44675 Windows Bluetooth Driver Elevation of Privilege Vulnerability
ASPY: 389: Malicious-exe exe.MP_293

CVE-2022-44683 Windows Kernel Elevation of Privilege Vulnerability
ASPY: 388: Malicious-exe exe.MP_292

CVE-2022-44698 Windows SmartScreen Security Feature Bypass Vulnerability
ASPY: 390: Malformed-File js.MP_27

The following vulnerabilities do not have exploits in the wild :
CVE-2022-24480 Outlook for Android Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-41074 Windows Graphics Component Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-41076 PowerShell Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41077 Windows Fax Compose Form Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-41089 .NET Framework Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-41094 Windows Hyper-V Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-41121 Windows Graphics Component Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-41127 Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44666 Windows Contacts Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44667 Windows Media Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44668 Windows Media Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44669 Windows Error Reporting Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-44670 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44671 Windows Graphics Component Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-44674 Windows Bluetooth Driver Information Disclosure Vulnerability
389There are no known exploits in the wild.
CVE-2022-44676 Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
389There are no known exploits in the wild.
CVE-2022-44677 Windows Projected File System Elevation of Privilege Vulnerability
388There are no known exploits in the wild.
CVE-2022-44678 Windows Print Spooler Elevation of Privilege Vulnerability
390There are no known exploits in the wild.
CVE-2022-44679 Windows Graphics Component Information Disclosure Vulnerability
There are no known exploits in the wild.
CVE-2022-44680 Windows Graphics Component Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-44681 Windows Print Spooler Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-44682 Windows Hyper-V Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-44687 Raw Image Extension Remote Code Execution Vulnerability
389There are no known exploits in the wild.
CVE-2022-44689 Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
388There are no known exploits in the wild.
CVE-2022-44690 Microsoft SharePoint Server Remote Code Execution Vulnerability
390There are no known exploits in the wild.
CVE-2022-44691 Microsoft Office OneNote Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44692 Microsoft Office Graphics Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44693 Microsoft SharePoint Server Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44694 Microsoft Office Visio Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44695 Microsoft Office Visio Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44696 Microsoft Office Visio Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44697 Windows Graphics Component Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-44699 Azure Network Watcher Agent Security Feature Bypass Vulnerability
There are no known exploits in the wild.
CVE-2022-44702 Windows Terminal Remote Code Execution Vulnerability
There are no known exploits in the wild.
CVE-2022-44704 Microsoft Windows Sysmon Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-44707 Windows Kernel Denial of Service Vulnerability
There are no known exploits in the wild.
CVE-2022-44710 DirectX Graphics Kernel Elevation of Privilege Vulnerability
There are no known exploits in the wild.
CVE-2022-44713 Microsoft Outlook for Mac Spoofing Vulnerability
There are no known exploits in the wild.

Cybersecurity News & Trends – 12-09-2022

/0 Comments/in /by

Bringing you curated cybersecurity news and trends from leading news outlets and bloggers that monitor IT security worldwide.

It’s the end of the year, and SonicWall still manages to produce headlines, including big news that its next-generation firewalls were a winner in CRN’s prestigious 2022 Products of the Year Awards.

From industry news, Dark Reading reports three ways attackers bypass cloud security. Then, Hacker News published a report about a new ‘Truebot’ malware variant that leverages the Netwrix auditor bug and the Raspberry Robin worm. From SC Magazine, we learned that most US defense contractors are failing basic cybersecurity requirements. Bleeping Computer reports that Rackspace confirms a ransomware attack caused the outage they experienced earlier this week. Krebs on Security lays out a new and devious attack strategy that targets executives of telemedicine companies. Finally, CyberNews reveals the weakest (and worst) passwords of 2022, with a retrospect from a report from Forbes. Despite all the news and the warnings, people are still using simple and very hackable passwords. Read these lists to see if your password is one of them.

Remember that cybersecurity is everyone’s business. Be safe out there!

SonicWall News

The Art of Cyberwarfare: Sun Tzu and Cybersecurity

Solutions Numeriques (FR), Reprint from SonicWall Blog: SonicWall is organizing an event on this theme of the Art of War: December 15, presented by Guillaume Sevrin, SonicWall EMEA pre-sales manager.

Ransomware Gang Makes $100 Million

Cyber Security Intelligence, SonicWall News: The retail sector is a specific target for Hive ransom attacks and this confirmed by an authoritative threat report by SonicWall, which found that retailers saw a 90% increase in ransomware attacks in 2022, whereby hackers attempt to cripple their day-to-day infrastructure.

Why The Race to Deliver Products Faster Could Be Hampering Product Security

Business Reporter, SonicWall News: Combining these factors with the avalanche of cyber-attacks on connected devices makes the challenge even more insurmountable. According to SonicWall, the total number of malware attacks on IoT-enabled devices rose by 77 per cent in the first half of 2022 to an alarming 57 million. The number of “never-before-seen” malware variants, that are the hardest to defend against, also rose by 45 per cent in the period.

SonicWall Earns Multiple Channel Awards, Delivers More Value and Savings to Global Partner Community

PR Newswire, SonicWall News: SonicWall today announced that its next generation firewalls were a winner in CRN’s prestigious 2022 Products of the Year Awards, notching yet another award in an impressive run for the company that is diligently driving new and innovative strategies to its partners offset rising costs industry-wide.

Infinigate To ‘Take Breath’ Before Shifting M&A Focus to Bolt-On Deals, UK Boss Reveals

CRN UK, SonicWall News: “Looking at the enlarged UK business, Griffiths said that Nuvias hands it “scale and power”. While Infinigate’s largest vendors were Progress Software and SonicWall, Nuvias held bigger partnerships with the likes of Juniper Networks.”

Chartered Status and Aligned Standards Are Crucial for The UK’s Cyber Sector

Computer Weekly, SonicWall News: SonicWall’s 2022 Cyber threat report states that ransomware incidents on governments across the globe increased by 1,885% last year, with the healthcare industry alone suffering a 755% increase.

Benefits Of VPN For Small Businesses

GIS User, SonicWall News: We recommend using a reliable VPN service that uses military-grade encryption, such as SonicWall VPN. It has a wide range of features and is very affordable. It is important to note that not all VPN services are created equal, so it is essential to do your research before choosing one.

Cyber Predictions for 2023

Cyber Magazine, SonicWall News: We can expect smaller scale attacks, for lower amounts of money, but which target a much broader base. The trend will probably hit education providers hard: education is already the sector most likely to be targeted by a malware, cryptojacking or encrypted attack, according to SonicWall’s 2022 Cyber Threat Report.

7 Steps to Future-Proof Your MSP Business and Stay Relevant

G2, SonicWall News: In 2021, SonicWall recorded 623.2 million ransomware attempts globally, an increase of 105% year-over-year. Just ransomware attacks.

Firewall Cybersecurity Providers You Should Know

Channel Futures, SonicWall News: Montenegro said SonicWall is a top NGFW provider. In March, SonicWall announced that 2021 was its best year on record. Propelled by the delivery of high-demand products, including the evolution of its Generation 7 NGFWs and a focus on its customers, SonicWall delivered record levels of sales and profitability in 2021.

How Remote Working Impacts Security Incident Reporting

CSO Online, SonicWall News: System- and endpoint-based security incident reporting and response can be negatively impacted by remote working too, says Immanuel Chavoya, emerging threat detection expert at SonicWall. “For instance, if the system flagged a user’s machine for a malware intrusion, there may be some delay in the security team being able to make any necessary updates, whereas, in person, the security engineer can immediately access the device and take any necessary action.

Malware, Spyware, and Ransomware: How They Differ and How to Respond

JD Supra, SonicWall News: Data from SonicWall Capture Labs revealed that the first half of 2022 saw an 11% increase in malware attacks compared to 2021, totaling around 2.8 billion attacks globally. Furthermore, over 2022, 35% of respondents have stated that poor preparedness was to blame when they experienced business-disrupting cyberattacks. Therefore, it is essential to take the necessary precautions to secure your device by installing the appropriate malware protection and recognizing the signs of an infected system.

Cybersecurity For Investors – Why Digital Defenses Require Good Governance

Seeking Alpha, SonicWall News: Cyberattacks are very costly. In the first half of 2022, at least 2.8 billion malware attacks were recorded globally, an increase of 11% over the previous 12 months, according to cybersecurity company SonicWall.

Study Shows the Worrying Human Cost of Cyber Attacks

Technology Magazine, SonicWall News: Research by SonicWall recently found there is growing concern regarding cyberattacks. Amongst 66% of organizations surveyed; ransomware leads the distress as 91% of all customers cited it as their biggest concern. Phishing and spear-phishing (76%), as well as encrypted malware (66%), comprised the top three concerns.

Ransomware Is the Biggest Concern for Most Organizations

HelpNetSecurity, SonicWall News: SonicWall released the 2022 SonicWall Threat Mindset Survey which found that 66% of customers are more concerned about cyberattacks in 2022, with the main threat being focused on financially motivated attacks like ransomware.

Industry News

3 Ways Attackers Bypass Cloud Security

Dark Reading reporting from the “Black Hat Europe” conference held in London this year focused on one presentation that discusses how recent cloud-focused malware campaigns demonstrate that adversary groups have intimate knowledge of cloud technologies and their security mechanisms. And not only that, but they are also using that knowledge to their advantage. Attackers, being very opportunistic, are capitalizing on mistakes committed by the cloud customer. So, the article proposes that successful attacks in the cloud have more to do with the user than the [cloud] service provider, per se. Perhaps the most interesting development with these attacks is that they target serverless computing and containers. The ease with which hackers can compromise cloud resources makes many people very uneasy.

New TrueBot Malware Variant Leveraging Netwrix Auditor Bug and Raspberry Robin Worm

According to Hacker News, cybersecurity researchers reported an increase in TrueBot infections. These attacks primarily target Mexico, Brazil and Pakistan. Cisco Talos says the attackers behind the operation have moved from using malicious emails to alternative delivery methods, such as the exploitation of a now-patched remote code execution (RCE) flaw in Netwrix auditor that was exploited by the Raspberry Robin worm. Data theft and Clop ransomware execution were some of the significant aspects of the monitored activities. TrueBot is a Windows malware downloader. It’s been attributed to a threat actor identified by Group-IB Silence; a Russian-speaking crew believed to share an association with Evil Corp (aka DEV-0443) and T505.

Most US defense contractors fail basic cybersecurity requirements.

SC Magazine reports that nearly nine out of ten US defense contractors fail to meet bare cybersecurity minimums. The new stats are the product of a study conducted by CyberSheath where they surveyed 300 US-based Department of Defense (DoD) contractors. The survey found that just 13% of respondents score 70 or above in the Supplier Performance Risk System (SPRS), the Department of Defense’s primary system for assessing supplier and product risk for contractors who handle unclassified information. According to the Defense Federal Acquisition Regulation Supplement (DFARS), a score of 110 is required for full compliance.

Rackspace confirms outage was caused by ransomware attack

Bleeping Computer reports that the cloud computing provider Rackspace Technology, Inc. (NASDAQ: RXT) confirmed that a ransomware attack is behind an ongoing Hosted Exchange outage described as an “isolated disruption.” Rackspace says that the investigation, led by a cyber defense firm and its internal security team, is in its early stages with no info on “what, if any, data was affected.”

The cloud service provider says it will notify customers if it finds evidence that the attackers gained access to their sensitive information. The company also revealed during a press release and in their public 8-K SEC filing that it expects a loss of revenue due to the ransomware attack’s impact on its $30 million Hosted Exchange business.

New Ransom Payment Schemes Target Executives, Telemedicine

Ransomware groups constantly invent new ways to attack victims and convince them to pay. Krebs on Security reports that the new crop of strategies that have surfaced recently is particularly devious.

First, the ransomware group targets healthcare providers that offer online consultations and sends them booby-trapped records. The second one involves carefully editing executives’ emails at public companies to make it appear they were involved in insider trading.

The US Department of Health and Human Services (HHS) warned last month that Venus ransomware attacks had been detected against several US healthcare providers. Venus was first discovered in mid-August 2022. The group is also well-known for hacking into victims’ Remote Desktop services to encrypt Windows computers.

Venus group members have demonstrated a high-level ability to access victim agencies. However, the group has had difficulty getting paid. That’s why the change in strategies, Krebs believes, has led to attempted blackmail to frame public company executives for insider trading. Venus said it had recently succeeded in using a method that involved carefully editing email inboxes at victim firms to insert messages discussing plans for trading large volumes of company stock based on non-public information.

The Weakest (and worst) Passwords of 2022

We learned that despite growing cybersecurity awareness, old habits die hard. CyberNews reports that people still use weak passwords. They examined 56 million breached and leaked passwords in 2022 and discovered the password “123456” was used in 111,417 cases. Forbes ran a similar report in 2020 and found that the top two passwords on their list was found in 6,452,650 accounts. They also reported that many of these passwords take less than one second to crack. We recommend you click through to see if you use any of these passwords. If you are, then it is worth worrying about.

While most hacks are the product of phishing or ransomware attacks, a weak password opens you to a brute force attack that breaks into your account by guessing your password. Every password on both lists appears in a common database shared by hackers on the open web. That means the database is so common that a teenager with little knowledge can use automated software to probe thousands of accounts until they find yours.

Of the passwords scrutinized by the CyberNews report, around half (28 million) were ‘specific’ – consisting of a single simple name or word such as “dell.” About 5.5 million of these unique or specific passwords occurred multiple times. For instance, some use names of capital cities like “lima” (17,466) and “Rome” (17,407) and animal species such as “cat” (122,392) and “rat” (103,284). Again, whether these were chosen because of any personal significance to users or merely selected for their simplicity is unclear. These passwords can be just as easily hacked as well.

What’s clear from these two reports is that – despite all the terrible news about cyber threats and ransomware – there’s still a legion of ‘culprits’ out there who can’t be bothered to use password-managing apps or spend more time and effort creating complex combinations. And with this lack of attention or concern, cybersecurity takes a hit. These passwords not only spell bad news for users who abuse their cybersecurity but everyone else they associate with and communicate with.

SonicWall Blog

‘3 & Free’ Promotion: How to Upgrade to a New SonicWall TZ Series NGFW for Free – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

3 & Free: 1 Amazing Deal, 2 Exceptional Firewalls, 3 Years of Superior Threat Protection – Matt Brennan

SonicWall Wins CRN’s 2022 Tech Innovator Award in Enterprise Network Security – Bret Fitzgerald

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

A New Era of Partnering to Win – Robert (Bob) VanKirk

Multiply Your Security with Multifactor Authentication – Amber Wolff

10 Reasons to Upgrade to the Latest SonicWall Gen 7 TZ Firewall – Sarah Choi

SonicWall Third-Party Threat Performance: Seven Times Superior – Amber Wolff

Q3 2022 Threat Intelligence Highlights Changing Threat Environment in 2022 – Amber Wolff

Securing Your Credentials: Does Your Password Pass the Test? – Amber Wolff

The Power of Patching: Why Updating Your Software Should Be a Top Priority

Think Before You Click: Spotting and Stopping a Phish – Amber Wolff

National Cybersecurity Awareness Month Spotlights the Role of Individuals in Stopping Attacks – Amber Wolff

Seamless Security: How SonicWall Solutions Work Together to Safeguard Your Organization – Sarah Choi

SonicWall’s Nicola Scheibe Recognized by CRN as One of 2022’s 100 People You Don’t Know But Should – Bret Fitzgerald

SonicWall NSM 2.3.4 Uplevels Central Management Capabilities – Amber Wolff

Cybersecurity and the Metaverse: Virtual and Real Threats – Ray Wyman

Why 5G Needs to Start with Secure Network Access – Rishabh Parmar

Security Platform Vendors vs. Best-of-Breed Approach to Security Architecture – Rajesh Agnihotri

Why Organizations Should Adopt Wi-Fi 6 Now – David Stansfield

Centreon SQL Injection Vulnerability

/in /by

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  Centreon is a network, system and application monitoring tool. Centreon is the only AIOps Platform Providing Holistic Visibility to Complex IT Workflows from Cloud to Edge.

  A SQL Injection vulnerability has been reported in the Centreon Web Poller Resource module. The vulnerability is due to insufficient input validation.

  A remote, authenticated attacker could exploit this vulnerability by sending a maliciously crafted request to the server. A successful attack may result in arbitrary SQL command execution against the database on the target server.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-41142.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C).

  Base score is 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is low.
    • User interaction is none.
    • Scope is unchanged.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 7.7 (E:U/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is unproven.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  An SQL injection vulnerability exists in Centreon Web, it’s due to insufficient validation of the resource_activate request parameter when adding a new poller resource. An HTTP POST request is sent to /centreon/main.get.php with a parameter p set to “60904”, main.get.php loads the script www/include/configuration/configResources/resources.php which reads the value of parameter o.

  When adding poller resources parameter o is set to “a”, and resources.php loads the script www/include/configuration/configResources/formResources.php. formResources.php reads the submitA request parameter, and if present calls the function insertResourceInDB() in script www/include/configuration/configResources/DBFunc.php.

  insertResourceInDB() calls insertResource() in the same script, then insertResource() assembles an SQL query based on the request parameters and executes. insertResource() sanitizes some of the request parameters, however it fails to sanitize resource_activate. See “Attack Delivery” below for an example of the HTTP POST request that injects an SQL statement against the Centreon database.

Triggering the Problem:

  • The target must have the vulnerable software installed.
  • The attacker must have network connectivity to the target server.
  • The attacker must have access to Configuration > Pollers > Resources page.

Triggering Conditions:

  The attacker authenticates to the server and receives a valid token. Next, the attacker sends an HTTP request with a malicious resource_activate[resource_activate] parameter. The vulnerability is triggered when the server processes the request.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • HTTP
    • HTTPS

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 4098 Web Application SQL Injection (CREATE TABLE) 3

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Updating to a non-vulnerable version of the product.
    • Filtering attack traffic using the signature above.
  The vendor has released the following patch regarding this vulnerability:
  Vendor Advisory

Cybersecurity News & Trends – 12-02-2022

/0 Comments/in /by

Each week SonicWall curates the cybersecurity industry’s most compelling, trending and important interviews, media and news stories — just for you.

SonicWall is on a roll with cyber news reporters and bloggers. Check out the line-up, and you’ll see a steady pace of SonicWall in the news with our marketing initiatives, the Cyber Threat Reports and the 2022 SonicWall Threat Mindset Survey.

Speaking of steady paces, the news from the industry hasn’t slowed either. Dark Reading reports that the cybersecurity forecast for 2023 is more disruption. Security Magazine reports on the realization that hackers are getting behind the psychological effect of their attacks. Krebs on Security explains how ConnectWise quietly patched a flow that helped phishers. According to Hacker News, hackers sign android malware apps with compromised platform certificates. The Record reports that several major car brands have begun fixing vulnerabilities that would have allowed hackers to remotely control the locks, engine, horn, headlights, and trunk of certain cars made after 2012. SC Magazine tells us that most US defense contractors fail basic cybersecurity requirements. And finally, Dark Reading offers details on how CISA’s strategic plan is ushering in a new era for cybersecurity.

Remember that cybersecurity is everyone’s business. Be safe out there!

SonicWall News

Chartered Status and Aligned Standards Are Crucial For The UK’s Cyber Sector

Computer Weekly, SonicWall News: SonicWall’s 2022 Cyber threat report states that ransomware incidents on governments across the globe increased by 1,885% last year, with the healthcare industry alone suffering a 755% increase.

Benefits Of VPN For Small Businesses

GIS User, SonicWall News: We recommend using a reliable VPN service that uses military-grade encryption, such as SonicWall VPN. It has a wide range of features and is very affordable. It is important to note that not all VPN services are created equal, so it is essential to do your research before choosing one.

Cyber Predictions for 2023

Cyber Magazine, SonicWall News: We can expect smaller scale attacks, for lower amounts of money, but which target a much broader base. The trend will probably hit education providers hard: education is already the sector most likely to be targeted by a malware, cryptojacking or encrypted attack, according to SonicWall’s 2022 Cyber Threat Report.

7 Steps to Future-Proof Your MSP Business and Stay Relevant

G2, SonicWall News: In 2021, SonicWall recorded 623.2 million ransomware attempts globally, an increase of 105% year-over-year. Just ransomware attacks.

Firewall Cybersecurity Providers You Should Know

Channel Futures, SonicWall News: Montenegro said SonicWall is a top NGFW provider. In March, SonicWall announced that 2021 was its best year on record. Propelled by the delivery of high-demand products, including the evolution of its Generation 7 NGFWs and a focus on its customers, SonicWall delivered record levels of sales and profitability in 2021.

How Remote Working Impacts Security Incident Reporting

CSO Online, SonicWall News: System- and endpoint-based security incident reporting and response can be negatively impacted by remote working too, says Immanuel Chavoya, emerging threat detection expert at SonicWall. “For instance, if the system flagged a user’s machine for a malware intrusion, there may be some delay in the security team being able to make any necessary updates, whereas, in person, the security engineer can immediately access the device and take any necessary action.”

Malware, Spyware, and Ransomware: How They Differ and How to Respond

JD Supra, SonicWall News: Data from SonicWall Capture Labs revealed that the first half of 2022 saw an 11% increase in malware attacks compared to 2021, totaling around 2.8 billion attacks globally. Furthermore, over 2022, 35% of respondents have stated that poor preparedness was to blame when they experienced business-disrupting cyberattacks. Therefore, it is essential to take the necessary precautions to secure your device by installing the appropriate malware protection and recognizing the signs of an infected system.

Cybersecurity For Investors – Why Digital Defenses Require Good Governance

Seeking Alpha, SonicWall News: Cyberattacks are very costly. In the first half of 2022, at least 2.8 billion malware attacks were recorded globally, an increase of 11% over the previous 12 months, according to cybersecurity company SonicWall.

Study Shows the Worrying Human Cost of Cyber Attacks

Technology Magazine, SonicWall News: Research by SonicWall recently found there is growing concern regarding cyberattacks. Amongst 66% of organizations surveyed; ransomware leads the distress as 91% of all customers cited it as their biggest concern. Phishing and spear-phishing (76%), as well as encrypted malware (66%), comprised the top three concerns.

Ransomware Is the Biggest Concern for Most Organizations

HelpNetSecurity, SonicWall News: SonicWall released the 2022 SonicWall Threat Mindset Survey which found that 66% of customers are more concerned about cyberattacks in 2022, with the main threat being focused on financially motivated attacks like ransomware.

The Four Biggest Security Risks Facing Retailers in The Next Five Years

Retail Week, SonicWall News: Research shows the retail sector has been one of the top targets among cybercriminals, with a surge of more than 200% in ransomware attacks over the past year, according to SonicWall. Many retailers went through a digital transformation during the pandemic to allow customers to switch from in-store to online purchasing, which created more vulnerabilities and avenues for cybercrime.

Weekly Roundup

Channel Pro Network, SonicWall News: The recent 2022 SonicWall Cyber Threat Mindset Survey, including third quarter information, reported that customers saw an average of 1,014 ransomware attempts, a flood even though the total dropped 31% below attempts in 2021. 91% reported they were most concerned about ransomware attacks, a rising source of anxiety for security professionals. Ransomware-as-a-Service offerings make it easy to attack, and perpetrators are increasingly targeting financial firms with cryptojacking attempts, which were up 35% in the quarter. SonicWall’s Real-Time Deep Memory Inspection tools identified 375,756 malware variants never seen before during the first three quarters of 2022.

Latest SonicWall Intelligence Reveals Unstable Cyber Threat Landscape

European Business, SonicWall News: Being a security professional has never been more difficult,” said SonicWall President and CEO Bob VanKirk. “The cyber warfare battlefront continues to shift, posing dangerous threats to organizations of all sizes. With expanding attack surfaces, growing numbers of threats and the current geo-political landscape, it should be no surprise that even the most seasoned IT professional can feel overwhelmed. Armed with the latest cybersecurity tools, SonicWall partners can play a vital role in helping customers stay secure in even the most dynamic threat environments.”

Industry News

Cybersecurity Forecast: More Disruption

SonicWall reported an 11% increase in malware attacks in the first half of 2022 compared to 2021. This equates to around 2.8 billion global attacks. This report by Dark Reading predicts that 2023 will witness more of the same. Cyberattacks highlight one of the changes in advanced persistent threat attacks (APTs) in the last year. In 2022, geopolitical tensions escalated, and cyber operations entered the fray as a tactical tool. Experts say that while Russia and other countries have used cyberattacks to support military operations, the current war is the longest-running cyber operation and will continue to do so.

The Microsoft Threat Intelligence Centre reports that military conflict will become a driving force behind APT group formations in the next year.

The Psychological Warfare of Ransomware Attacks

Sun Tzu correctly stated that military leaders should choose easy battles they know they can win. In a report from Security Magazine, cyberwar experts talk about how hackers know their capabilities and keep improving their techniques to pull off sophisticated attacks with little brute force. IBM data shows that ransomware has been the most common form of attack over three years and accounted for 21% of all attacks. Not only are businesses with large pockets targeted, but so are other organizations. Hackers also target less well-known victims.

The Los Angeles School District, one of the largest in the country, recently fell victim to a ransomware attack. Following the attack, US law enforcement warned Americans school districts could see a rise in attacks due to the sensitive nature of student data.

Hackers understand how to weaponize attacks. They know that few people will shed tears when corporate entities are the victim. By targeting delicate information about a loved one, people are more easily coerced. Simply put, hackers are waging psychological warfare to get the money they seek, and technology alone isn’t enough to stop them from accomplishing their end goal.

ConnectWise Patches a Flaw That Helped Phishers

ConnectWise offers a self-hosted, remote desktop software application that is widely used by Managed Service Providers (MSPs). According to Krebs on Security, the vendor is warning of a sophisticated phishing attack that could allow attackers to take remote control of user systems if recipients click the link. This warning comes weeks after the company patched a vulnerability that made it easier for hackers to launch these attacks. According to a researcher, the ConnectWise client executable files are generated using client-controlled parameters. An attacker could create a ConnectWise client download link to bounce or proxy remote connections from MSP’s servers to a server the attacker controls.

Hackers Sign Android Malware Apps with Compromised Platform Certificates

Platform certificates used by Android smartphone vendors like Samsung, LG, and MediaTek have been found to be linked to malicious apps. According to The Hacker News, researchers discovered that Android apps run with a highly-privileged user ID – android.uid.system. This user ID has system permissions, including access to user data. A rogue app can be signed with the same certificate to gain access to all the privileges of the Android operating system. This allows it to steal sensitive information from any compromised device. The platform certificate is used to sign an application with system images.

Big Bugs Under the Hood

Several major car brands have begun fixing vulnerabilities that would have allowed hackers to remotely control the locks, engine, horn, headlights, and trunk of certain cars made after 2012, according to report from The Record.

In some cases, an attacker may scan the vehicle’s VIN number to compromise the apps. VINs are easily found through the windshield on a dashboard. As a result, Hyundai has updated its app. Sirius, which offers wireless broadcasting services to car owners, also updated its mobile application.

Although the vulnerability has been fixed, the root issue is an access control vulnerability that affects the app’s user accounts. If you had their email address, you could log in to any account and remotely locate their vehicle. Security experts stated that attacks could literally happen “from anywhere.”

Most US Defense Contractors Fail Basic Cybersecurity Requirements

According to SC Magazine, nearly nine out of ten US defense contractors fail to meet basic cybersecurity minimums, according to research commissioned by CyberSheath. According to the research, 13% of the 300 US-based Department of Defense contractors scored 70 or higher in the Supplier Performance Risk System. This is the primary system used by the Department of Defense to assess supplier and product risk. Contractors who work with unclassified information are not subject to this score. A score of 110 is required to comply with the Defense Federal Acquisition Regulation Supplement (DFARS).

CISA’s Strategic Plan Is Ushering in a New Cybersecurity Era

Today’s cyber environment requires less emphasis on detection and perimeter defenses and more focus on bolstering security with resilience, according to a report from Dark Reading. The federal government once again indicated that the traditional cybersecurity approach, based on perimeter defenses and prevention, is failing. In the last two years, ransomware has been used to attack 76% of organizations, while 66% were affected by at least one supply chain attack. The Cybersecurity and Infrastructure Security Agency (CISA) is now the latest federal entity to overhaul cybersecurity best practices. This underscores the need for drastic changes to withstand today’s dynamic threat landscape.

SonicWall Blog

‘3 & Free’ Promotion: How to Upgrade to a New SonicWall TZ Series NGFW for Free – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

3 & Free: 1 Amazing Deal, 2 Exceptional Firewalls, 3 Years of Superior Threat Protection – Matt Brennan

SonicWall Wins CRN’s 2022 Tech Innovator Award in Enterprise Network Security – Bret Fitzgerald

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

A New Era of Partnering to Win – Robert (Bob) VanKirk

Multiply Your Security with Multifactor Authentication – Amber Wolff

10 Reasons to Upgrade to the Latest SonicWall Gen 7 TZ Firewall – Sarah Choi

SonicWall Third-Party Threat Performance: Seven Times Superior – Amber Wolff

Q3 2022 Threat Intelligence Highlights Changing Threat Environment in 2022 – Amber Wolff

Securing Your Credentials: Does Your Password Pass the Test? – Amber Wolff

The Power of Patching: Why Updating Your Software Should Be a Top Priority – Amber Wolff

Think Before You Click: Spotting and Stopping a Phish – Amber Wolff

National Cybersecurity Awareness Month Spotlights the Role of Individuals in Stopping Attacks – Amber Wolff

Seamless Security: How SonicWall Solutions Work Together to Safeguard Your Organization – Sarah Choi

SonicWall’s Nicola Scheibe Recognized by CRN as One of 2022’s 100 People You Don’t Know But Should – Bret Fitzgerald

SonicWall NSM 2.3.4 Uplevels Central Management Capabilities – Amber Wolff

Cybersecurity and the Metaverse: Virtual and Real Threats – Ray Wyman

Why 5G Needs to Start with Secure Network Access – Rishabh Parmar

Security Platform Vendors vs. Best-of-Breed Approach to Security Architecture – Rajesh Agnihotri

Why Organizations Should Adopt Wi-Fi 6 Now – David Stansfield

Apache Airflow DAG Injection Vulnerability

/in /by

Overview:

  SonicWall Capture Labs Threat Research Team has observed the following threat:

  Apache Airflow is an open-source workflow management platform. Apache Airflow is a flexible, scalable workflow automation and scheduling system for authoring and managing Big Data processing pipelines. Written in Python, the project is highly extensible and able to run tasks written in other languages, allowing integration with commonly used architectures and projects such as AWS S3, Docker, Apache Hadoop HDFS, Apache Hive, Kubernetes, MySQL, Postgres, Apache Zeppelin, and more.

  Airflow originated at Airbnb in 2014 and was submitted to the Apache Incubator March 2016. The Apache Software Foundation (ASF), the all-volunteer developers, stewards, and incubators of more than 350 Open Source projects and initiatives, announced Apache® Airflow™ as a Top-Level Project (TLP).

  A OS command injection vulnerability has been reported in Apache Airflow. This vulnerability is due to improper input validation for parameters for directed acyclic graphs (DAGs).

  A remote, authenticated attacker could exploit this vulnerability by sending a crafted request to the target server. Successfully exploiting this vulnerability could result in OS command injection.

  Vendor Homepage

CVE Reference:

  This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2022-24288.

  CVE Listing

Common Vulnerability Scoring System (CVSS):

  The overall CVSS score is 8.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C).

  Base score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), based on the following metrics:
    • Attack vector is network.
    • Attack complexity is low.
    • Privileges required is low.
    • User interaction is none.
    • Scope is changed.
    • Impact of this vulnerability on data confidentiality is high.
    • Impact of this vulnerability on data integrity is high.
    • Impact of this vulnerability on data availability is high.
  Temporal score is 8.6 (E:U/RL:O/RC:C), based on the following metrics:
    • The exploit code maturity level of this vulnerability is unproven.
    • The remediation level of this vulnerability is official fix.
    • The report confidence level of this vulnerability is confirmed.

  CVSS Calculator Metrics

Technical Overview:

  Airflow is designed under the principle of “configuration as code”. While other “configuration as code” workflow platforms exist using markup languages like XML, using Python allows developers to import libraries and classes to help them create their workflows. Apache Airflow utilizes the Django web application framework that implements a model-template-views (MTV) architectural pattern.

  Directed Acyclic Graphs (DAGs) are collections of tasks users are able to execute; organized in a way that reflects their relationships and dependencies. Airflow uses directed acyclic graphs (DAGs) to manage workflow. There are a number of operations that can be performed including: triggering a DAG task, selecting a graph, viewing trees, deleting DAGs, and viewing code. The Base Airflow install includes examples of DAGs to demonstrate various features inside its package installer.

  The example DAG (example_passing_params_via_test_command), shows a templated command with arguments using echo to print a string. The raw arguments of “foo” and “miff” are added to a flat command string and passed to the BashOperator class to execute a Bash command.

Triggering the Problem:

  • The target host must have the affected version of the product installed and running.
  • The attacker must have network access to the target system.
  • The vulnerable DAG must be un-paused.
  • The attacker must have access to an account with the RESOURCE_DAG_RUN permission

Triggering Conditions:

  A malicious POST request is sent to the target server to run the vulnerable DAG.

Attack Delivery:

  The following application protocols can be used to deliver an attack that exploits this vulnerability:
    • HTTP
    • HTTPS

SonicWall’s, (IPS) Intrusion Prevention System, provides protection against this threat:

  • IPS: 2606 Apache Airflow DAG Command Injection 1
  • IPS: 2607 Apache Airflow DAG Command Injection 2

Remediation Details:

  The risks posed by this vulnerability can be mitigated or eliminated by:
    • Upgrading the product to a non-vulnerable version.
    • Filtering traffic based on the signatures above.
    • Deleting the vulnerable DAG.
    • Minimizing the number of users with the RESOURCE_DAG_RUN permission.
  The vendor has released the following advisory regarding this vulnerability:
  Vendor Advisory

‘3 & Free’ Promotion: How to Upgrade to a New SonicWall TZ Series NGFW for Free

/0 Comments/in /by

The use of malware — including variants like ransomware — is becoming more unpredictable than ever. As threat actors and cybercriminals shift tactics to bypass existing security measures, it’s never been more critical to ensure your organization is protected by the latest and most cost-effective firewall appliance and real-time security services.

That’s why, for a limited time, SonicWall is making it easy for you to upgrade to the latest SonicWall TZ370 and TZ470 firewall appliances with the return of our ‘3 & Free’ promotion.

What is the SonicWall ‘3 & Free’ Promotion?

The limited-time SonicWall 3 & Free promotion is the easy, cost-effective way for customers to upgrade to the very latest SonicWall next-generation firewall appliance for free.

Protect your brand, customers and data while stopping advanced cyberattacks, filtering dangerous content and enjoying 24x7 support

Taking advantage of the promotion couldn’t be simpler: Through April 30, 2023, current SonicWall customers (or those looking to swap out a competitor’s appliance) can receive a complimentary TZ370 or TZ470 appliance just by purchasing three years of SonicWall’s Advanced Protection Service Suite (APSS).

This security suite includes everything you need to stay protected against today’s modern attacks, including advanced malware, ransomware, encrypted threats, viruses, spyware, zero-day exploits and more. The comprehensive package includes:

  • Capture Advanced Threat Protection with RTDMITM
  • Gateway Anti-Virus
  • Anti-Spyware
  • Intrusion Prevention
  • Application Firewall Service
  • Content Filtering Services
  • Comprehensive Anti-Spam
  • NSM Essential with Management and 7-Day Reporting and 24×7 Firmware Support

SonicWall’s award-winning Capture ATP is a cloud-based, multi-engine sandbox that can detect and block the most advanced threats before they have the chance to infect your network.

Included as part of Capture ATP, SonicWall’s patented RTDMI™ technology leverages proprietary memory inspection, CPU instruction tracking and machine-learning capabilities to become increasingly efficient at recognizing and mitigating never-before-seen attacks. This includes attacks that traditional sandboxes will likely miss, such as threats that don’t exhibit any malicious behavior and hide their weaponry via encryption.

In addition to industry-leading threat capabilities and simplified management, you’ll also enjoy the superior performance of SonicOS7 — our most powerful operating system yet, redeveloped from the ground up to be more agile, flexible and user-friendly than any of its predecessors.